VYPR
← All advisories
Critical severityOSV Advisory· Published Jan 20, 2026· Updated Jan 21, 2026

CVE-2025-65482

CVE-2025-65482

Description

An XML External Entity (XXE) vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .docx file.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
fr.opensagres.xdocreport:fr.opensagres.xdocreport.documentMaven
>= 0.9.2, < 2.0.42.0.4

Affected products

1
  • Opensagres/XdocreportOSV
    Range: xdocreport-parent-1.0.5, xdocreport-parent-1.0.6, xdocreport-parent-2.0.0, …

Patches

1
d9b90ae6c948

fix XXE security issue (#547)

https://github.com/opensagres/xdocreportleandev-lilyApr 19, 2022via ghsa
commit
1 file changed · +4 −0
  • document/fr.opensagres.xdocreport.document/src/main/java/fr/opensagres/xdocreport/document/preprocessor/sax/SAXXDocPreprocessor.java+4 −0 modified
    @@ -56,6 +56,10 @@ public boolean preprocess( String entryName, InputStream reader, Writer writer,
         try

         {

             XMLReader xmlReader = XMLReaderFactory.createXMLReader();

+            //To avoid xxe security issue

+            xmlReader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);

+            xmlReader.setFeature("http://xml.org/sax/features/external-general-entities", false);

+            xmlReader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);

             BufferedDocumentContentHandler<?> contentHandler =

                 createBufferedDocumentContentHandler( entryName, fieldsMetadata, formatter, sharedContext );

             xmlReader.setContentHandler( contentHandler );

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.